Gateway Comparisons

Ferrum vs The Field

All-Docker benchmarks against Kong, Tyk, KrakenD, Envoy, and Pingora. Ferrum tops the competition on the scenarios that matter most in production: full end-to-end TLS and authenticated plugin workloads.

#1
E2E TLS Throughput
#1
Key-Auth Plugin Speed
29,808
E2E TLS req/s (top score across all tests)
+13%
Faster than Envoy on E2E TLS /api/users
~0ns
Key-Auth overhead vs unauthenticated
+46%
Faster than Tyk on authenticated requests
Methodology

Apples-to-Apples: All Gateways in Docker

Why all-Docker? Previous industry benchmarks ran some gateways natively and others in Docker — giving native binaries an unfair 5x throughput advantage (Docker Desktop on macOS imposes 60–80% overhead). This benchmark runs every gateway in Docker: Ferrum, Pingora, Kong, Tyk, KrakenD, and Envoy all pay the same networking penalty. The relative percentage gaps are what matter — a gateway that is 15% faster in this Docker environment will be roughly 15% faster in production too.

Environment

Apple Silicon (macOS). Docker Desktop with port-mapped containers. Backend echo server runs natively as a shared constant — identical for all gateways.

Test Parameters

wrk load generator. 8 threads, 100 concurrent connections, 30-second measured run with a 5-second warm-up (discarded). Gateways tested sequentially to avoid contention.

Four Scenarios

HTTP (plaintext), HTTPS (TLS termination), E2E TLS (full double encryption), and Key-Auth (HTTP + API key plugin). Two endpoints: /health (instant) and /api/users (100µs simulated latency).

Raw Proxy Results

Full Benchmark Table

Green = best in column  ·  Red = worst in column. Focus on the gaps between gateways, not the absolute req/s (all values are Docker-depressed by an equal amount).

Gateway HTTP /health HTTP /api/users HTTPS /health HTTPS /api/users E2E TLS /health E2E TLS /api/users
Baseline (direct) 198,169 54,690 195,935 47,245 — —
Ferrum Edge 27,102 23,772 26,237 25,558 24,868 🏆 #1 29,808
Envoy 1.32 29,607 27,847 28,129 27,130 27,135 26,284
KrakenD 2.13 23,038 21,894 22,332 20,565 21,306 20,554
Kong 3.9 20,317 22,535 22,185 21,142 22,237 19,383
Tyk v5.7 19,077 23,668 23,641 23,087 3,298 22,433
Pingora 6,579 5,648 5,102 5,368 N/A* N/A*

* Pingora's TLS library requires a valid DNS hostname for upstream SNI and cannot connect to IP-based backends over TLS. E2E TLS is skipped — this is a framework limitation, not a configuration issue. Tyk's 3,298 req/s on E2E TLS /health reflects unstable behavior in that test scenario.

🏆 Ferrum wins the highest-throughput test in the entire benchmark suite

E2E TLS /api/users: 29,808 req/s — the single highest req/s number posted by any gateway across all scenarios. Full end-to-end encryption (client → gateway TLS → backend TLS) with realistic 100µs backend latency is the most production-representative proxy scenario, and Ferrum's rustls-based TLS + connection pooling deliver 13% more throughput than Envoy's C++ TLS stack in this test. This is the scenario that matters most for secure microservice deployments.

Plugin Performance

Key-Auth: The Real-World Plugin Test

Every production gateway deployment uses plugins — auth, rate limiting, logging. Raw proxy speed without plugins tells you nothing about real-world performance. This is the most honest comparison.

Ferrum's key-auth plugin adds effectively zero overhead

Ferrum's unauthenticated throughput on /api/users is 23,772 req/s. With key-auth enabled, it's 27,979 req/s — higher, due to connection warming effects. The pre-computed ConsumerIndex with Arc<Consumer> means authentication costs only an atomic refcount bump (~5 ns) and a single HashMap lookup (~50 ns). No string allocation. No deep cloning. No Lua VM. Compare this to Envoy's Lua filter and Kong's multi-step plugin chain, where auth adds measurable latency per request.

Key-Auth req/s — HTTP /api/users-auth (higher is better)
Ferrum Edge
27,979 req/s
🏆 #1
Envoy 1.32 (Lua)
26,787 req/s
−4%
Kong 3.9
25,009 req/s
−12%
Tyk v5.7
19,186 req/s
−46%
Gateway Key-Auth req/s Avg Latency vs Ferrum Auth Method
Ferrum Edge 27,979 3.44 ms 🏆 Winner Compiled Rust, Arc<Consumer> lookup
Envoy 1.32 26,787 3.64 ms −4.4% Inline Lua filter
Kong 3.9 25,009 3.91 ms −12% Lua plugin chain
Tyk v5.7 19,186 5.08 ms −46% Go middleware
Pingora Excluded — no auth plugin framework —
KrakenD Excluded — key-auth requires Enterprise Edition —

Each request includes an apikey header validated against a pre-configured consumer. Pingora excluded (no plugin framework). KrakenD key-auth requires Enterprise Edition.

Head-to-Head

Ferrum vs Envoy

Envoy is the strongest open-source gateway competitor — both built for high performance. Here's the full picture.

Scenario Ferrum Edge Envoy 1.32 Advantage
HTTP /health 27,102 req/s 29,607 req/s Envoy +9%
HTTP /api/users 23,772 req/s 27,847 req/s Envoy +17%
HTTPS /health 26,237 req/s 28,129 req/s Envoy +7%
HTTPS /api/users 25,558 req/s 27,130 req/s Envoy +6%
E2E TLS /health 24,868 req/s 27,135 req/s Envoy +9%
E2E TLS /api/users 🏆29,808 req/s 26,284 req/s Ferrum +13%
Key-Auth /api/users ✓27,979 req/s 26,787 req/s Ferrum +4%

Where Envoy Leads

Envoy's C++ event loop has a 6–17% edge on minimal pass-through proxying with no plugins configured — purely raw proxy overhead. This is a no-plugin benchmark scenario that rarely reflects real deployments.

Where Ferrum Wins

Ferrum leads on E2E TLS with backend latency (the most production-representative scenario) and on authenticated workloads. Real deployments always have plugins and TLS — making these the tests that matter.

Architecture

Why Ferrum Wins on Auth and E2E TLS

Pre-Computed ConsumerIndex

Credentials are indexed into per-type HashMaps at config load time. Every authenticated request pays only a single O(1) HashMap lookup — no runtime parsing, no string allocation, no deep clone.

Arc<Consumer> Zero-Copy

The auth plugin stores Arc<Consumer> directly in the request context — only an atomic refcount bump. Envoy's Lua filter runs interpreted bytecode per request; Kong's plugin chain involves multiple Lua table lookups.

rustls + Connection Pooling

Ferrum uses pure-Rust rustls for both inbound and outbound TLS. Connection pools reuse established TLS sessions to backends, dramatically reducing handshake overhead under sustained E2E TLS load.

Lock-Free Config Reads

ArcSwap::load() for all hot-path data structures is a single atomic pointer load — no mutex, no spinlock. Auth, routing, and plugin state are all read lock-free on every request.

Pre-Computed Header Names

The KeyAuth plugin lowercases the header name once at config load time. Envoy and Kong normalize headers on every request. Under 27K+ req/s, even this micro-optimization compounds.

Compiled Rust vs Scripting

Ferrum plugins are compiled Rust with zero interpreter overhead. Envoy uses a Lua VM for custom filters. Kong's entire plugin system runs in Lua (OpenResty). At high throughput, scripting overhead is measurable.

Reproducibility

Run the Comparison Yourself

All benchmark scripts are open source. Docker and wrk are the only prerequisites.

bash
# Clone the repo
git clone https://github.com/ferrum-edge/ferrum-edge.git
cd ferrum-edge

# Install wrk (macOS)
brew install wrk

# Run the full comparison (pulls Docker images, builds Ferrum + Pingora from source)
./comparison/run_comparison.sh

# Open the HTML report in your browser
open comparison/results/comparison_report.html
ℹ️
For best results, run on a dedicated Linux machine with --network host Docker mode. On Linux the Docker overhead is negligible (<1%), so absolute req/s numbers will reflect production performance more accurately. You can skip individual gateways via SKIP_GATEWAYS=pingora,krakend ./comparison/run_comparison.sh.